# CLI Authorization (/docs/account/cli-auth)



The `layers` CLI signs in using a browser-based PKCE OAuth flow. Run:

```bash
layers login
```

The CLI:

1. Opens your default browser to the sign-in page.
2. Starts a short-lived local HTTP listener on `127.0.0.1`.
3. Waits for the identity provider to redirect the authorization code
   back to that listener.
4. Exchanges the code for an access + refresh token and stores them locally.

If the browser can't be opened automatically, the CLI prints the URL so you
can paste it manually.

## Force re-authentication [#force-re-authentication]

```bash
layers login --force
```

Clears the current credentials and sends you back through the sign-in flow.
Useful when switching accounts.

## Sign out [#sign-out]

```bash
layers logout
```

Removes local credentials.

## Current identity [#current-identity]

```bash
layers whoami
```

Prints the signed-in email and user ID.

## Default org / project [#default-org--project]

```bash
layers orgs list
layers orgs switch <org-id>

layers projects list
layers projects switch <project-id>
```

Sets the default organization and project used by subsequent CLI commands.
If your account only has one org (or one project), `layers login` auto-sets
them for you.

## Partner API keys (for server-side use) [#partner-api-keys-for-server-side-use]

For backend integrations and CI/CD, generate a partner API key from
**Org → Settings → API Keys**. The partner API is organization-scoped and
does not expire until revoked or rotated. See
[API Keys](/docs/account/api-keys).